This privacy notice explains why this Practice keeps information about you and how that information may be used. This practice keeps personal and sensitive information about you that you have shared with us as part of your healthcare, your appointments, where you are seen and when you are seen, who by, referrals to specialists and other healthcare providers, tests carried out here and in other places, investigations and scans, treatments and outcomes of treatments, your treatment history, the observations and opinions of other healthcare workers, within and without the NHS as well as comments and aide memoires reasonably made by healthcare professionals in this practice who are appropriately involved in your health care. These records help to provide you with the best possible care.
GPs have always delegated tasks and responsibilities to others that work with them in their surgeries, on average an NHS GP has between 1,500 and 2,500 patients for whom he or she is accountable. It is not possible for the GP to provide hands on personal care for each and every one of those patients in those circumstances, for this reason GPs share your care with others, predominantly within the surgery but occasionally with outside organisations.
The information shared about you is used by the health and social care professionals looking after you to make sure they have the most up to date information available to them so that they can quickly assess you and make the best decisions or plans about your care. Healthcare organisations have different systems for managing your records, and this Practice uses the Medical Interoperability Gateway (MIG) to provide a “connected” electronic view between each of these different systems so that the people looking after you can immediately see important information from each of the services that you use, to help them make the best decisions about your care.
People who have access to your information will only have access to that which they need to fulfil their roles, for instance admin staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments, the practice nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts whilst the GP you see or speak to will normally have access to everything in your record.
The Care Act 2014, Children Acts 1989 & 2004 & Social Care Act 2014 explains the statutory responsibilities for healthcare professionals to protect members of society recognised as needing protection, for example children and adults with care and support needs. If a child/adult is suffering or likely to suffer significant harm, professionals have a statutory responsibility to protect them. Safeguarding is the action that is taken to promote the welfare and protect children/ adult from harm.
Where there is a suspected or actual safeguarding issue professionals aim to gain consent to share personal and sensitive information if appropriate. However some situations may place a child/adult at increased risk of harm if consent is sought. . Your information may therefore be shared without consent if a health or social care professional considers there is good reason to do so, and that the sharing of information will enhance safeguarding. Decisions to share or withhold information are recorded, including who has been given the information and why.
This is covered in the following legislation guidance:
- The Mental Capacity Act 2005
- Section 47 of The Children Act 1989
- Section 18 Schedule 1 Part 2 of Data Protection Bill 2018
- Section 45 of the Care Act 2014
For children where who are identified as Child In Need, professionals are required to seek consent in regards to sharing information. The relevant guidance is covered; Section 17 Children Act 1989.
We are required by Articles in the General Data Protection Regulations (GDPR) to provide you with the information in the following 10 subsections.
Controller contact details
New Hayesbank Surgery,
Bybrook, Kennington, Ashford, Kent, TN24 9JZ
Data Protection Officer contact details
Andrew Irvine
NHS Medway Clinical Commissioning Group,
Unit A, Compass Centre North, Pembroke Road,
Chatham Maritime, Kent, ME4 4YG
Purpose of the processing
Direct Care is care delivered to the individual alone, most of which is provided in the surgery. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.
For safeguarding the purpose of the processing is to protect the child or vulnerable adult.
Lawful basis for processing
The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR:
Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”
We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*
For safeguarding: the sharing is a legal requirement to protect vulnerable children or adults, therefore for the purposes of safeguarding children and vulnerable adults, the following GDPR Article 6 conditions apply:
For consented processing;
6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”
For unconsented processing;
Article 6(1)(e) “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;
And the following Article 9 condition for processing special category personal data:
Article 9(2)(b) “…is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of …social protection law in so far as it is authorised by Union or Member State law..”.
The sources of the data and the recipient or categories of recipients of the processed data
The MIG connects your GP system with the local hospital and other local healthcare providers, so your GP can see your hospital record and health professionals in hospitals and other local healthcare providers can see your GP record. In some areas, where other services are already sharing more information than this, then these services will also be included The information will be used to support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.
The organisations concerned are the East Kent Primary Care practices and
- Connect Health Ltd
- East Kent Hospitals University NHS Foundation Trust
- Integrated Care 24 Ltd
- Kent and Medway NHS and Social Care Partnership Trust
- Kent Community Health NHS Foundation Trust
- Medway Community Healthcare CIC
- Medway NHS Foundation Trust
- Pilgrims Hospices
For safeguarding: the data will be shared with the CCG Quality and Nursing Directorate Safeguarding teams.
Right to opt-out
You have the right at any time to opt out of electronic information sharing via the MIG. If you decide to opt out then no information will be shared about you via this system.
If you would prefer your information not be shared, you will need to contact your GP Practice.
Opting out of the MIG electronic record view does not mean that your information will not be shared between the people looking after you, just that it will continue to be shared as it is now – via phone, email, fax and letter. Therefore, your care will be no different to how it is now – you will just not be able to take advantage of the benefits that sharing your important information quickly and “in real time” could bring you – especially in emergency situations
You will need to tell each health and care professional looking after you about your medical history, your treatment, allergies and medications at every appointment or hospital visit. Decisions about your care may take longer and appointments and tests may be repeated.
Rights to object
You have the right to object to some or all the information being processed under Article 21. Please see section 6 of this privacy notice or alternatively, contact the Data Protection Officer at your Practice for more information. You should be aware that this is a right to raise an objection, which is not the same as having an absolute right to have your wishes granted in every circumstance.
For safeguarding: this sharing is a legal and professional requirement and therefore there is no right to object.
There is also GMC guidance for adult and child safeguarding:
Right to access and correct
You have the right to access the data that is being shared and have any inaccuracies corrected. This is known as ‘the right of subject access’.
If your health or care provider holds information about you, and you make a subject access request they will:
- Give you a description of it
- Tell you why it is being held
- Tell you who it could be shared with
- Let you have a copy of the information in an intelligible form.
If you would like to make a ‘subject access request’, you will need to contact your Practices.
There is no right to have accurate medical records deleted except when ordered by a Court of Law.
Retention period
The data will be retained in line with the law and national guidance. www.digital.nhs.uk/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the Practice.
For safeguarding: the data will be retained for active use during any investigation and thereafter retained in an inactive stored form according to the law and national guidance.
Right to complain
You have the right to complain to the Information Commissioner’s Office, you can use this link www.ico.org.uk/contact-us or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).
* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament. It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent.
The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.
In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient. It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.
Three circumstances making disclosure of confidential information lawful are:
- where the individual to whom the information relates has consented;
- where disclosure is in the public interest; and
- where there is a legal duty to do so, for example a court order.